ee1cd2c72482f464eee2321ee8e1fdb3a1f26fbba488ba96eb9ec5838fb29cf4

General

Target
ee1cd2c72482f464eee2321ee8e1fdb3a1f26fbba488ba96eb9ec5838fb29cf4
Size 912KB
Sample260721-seaeysbd36
SHA256 ee1cd2c72482f464eee2321ee8e1fdb3a1f26fbba488ba96eb9ec5838fb29cf4
MD5 801bc85db0246f7e241a0be55e3a04de
SHA1 811dbffd1f3fb48be4a0c9e1beea16f051befb39
SHA512 4f226778ba9977a5103a8fb1a6d5366d2a1dcd64689d95d5b3750abea87fec201bbf290c873cddad35a26b45ce83a02a1d4948eb67ee52ca46f90524fe7ecd0d
SSDEEP 12288:Iq1bsgShoHRyIqVNQFC36giXhHzfqt4VbRF8UusBq+:Iq1bsgSQhXzfqt4VxS+
TLSH
T16E15724BEBB611E5F4B6C1399963322AFC7234A547389BD797855A0A4B30FE4AC3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee1cd2c72482f464eee2321ee8e1fdb3a1f26fbba488ba96eb9ec5838fb29cf4

File Explorer

ee1cd2c72482f464eee2321ee8e1fdb3a1f26fbba488ba96eb9ec5838fb29cf4

.dll 912KB

ee1cd2c72482f464eee2321ee8e1fdb3a1f26fbba488ba96eb9ec5838fb29cf4

IMPHASH 106ce6a9923544d586b124c29a9d0a14
SHA256 ee1cd2c72482f464eee2321ee8e1fdb3a1f26fbba488ba96eb9ec5838fb29cf4
MD5 801bc85db0246f7e241a0be55e3a04de
SHA1 811dbffd1f3fb48be4a0c9e1beea16f051befb39
SHA512 4f226778ba9977a5103a8fb1a6d5366d2a1dcd64689d95d5b3750abea87fec201bbf290c873cddad35a26b45ce83a02a1d4948eb67ee52ca46f90524fe7ecd0d
SSDEEP 12288:Iq1bsgShoHRyIqVNQFC36giXhHzfqt4VbRF8UusBq+:Iq1bsgSQhXzfqt4VxS+
TLSH
T16E15724BEBB611E5F4B6C1399963322AFC7234A547389BD797855A0A4B30FE4AC3D340
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

wininet

InternetReadFile InternetOpenUrlW InternetCloseHandle InternetOpenW

kernel32

HeapSize CreateFileW CloseHandle ReadConsoleW ReadFile DuplicateHandle GetCurrentProcess CreateThread GetCurrentThread SuspendThread DisableThreadLibraryCalls FreeConsole GetConsoleWindow AddVectoredExceptionHandler RemoveVectoredExceptionHandler Sleep GetThreadContext SetThreadContext GetTickCount VirtualAlloc VirtualFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetModuleFileNameW HeapAlloc RtlUnwind HeapValidate GetSystemInfo IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetTempPathW IsThreadAFiber VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetProcessHeap GetStdHandle GetFileType SetConsoleCtrlHandler HeapFree HeapReAlloc HeapQueryInformation WriteFile OutputDebugStringW WriteConsoleW GetStringTypeW SetStdHandle GetFileSizeEx SetFilePointerEx

user32

ShowWindow

??0CPerfTrackProviderInfoCache@@QEAA@PEBVCProviderInfoCache@@@Z ??0CProviderInfoCache@@QEAA@_N@Z ??0CUTCProviderInfoCache@@QEAA@PEBVCProviderInfoCache@@@Z ??0KernelLoggingSession@@QEAA@AEBV0@@Z ??0KernelLoggingSession@@QEAA@PEBG0PEBUSESSION_PROPERTIES@@_N_K@Z ??0LoggingSession@@QEAA@AEBV0@@Z ??0LoggingSession@@QEAA@PEBG0PEBUSESSION_PROPERTIES@@_N_K@Z ??1CPerfTrackProviderInfoCache@@QEAA@XZ ??1CProviderInfoCache@@QEAA@XZ ??1CUTCProviderInfoCache@@QEAA@XZ ??1KernelLoggingSession@@UEAA@XZ ??1LoggingSession@@UEAA@XZ ??4CKernelStackWalkingFlagTranslator@@QEAAAEAV0@$$QEAV0@@Z ??4CKernelStackWalkingFlagTranslator@@QEAAAEAV0@AEBV0@@Z ??4CPerfTrackProviderInfoCache@@QEAAAEAV0@AEBV0@@Z ??4CProviderInfoCache@@QEAAAEAV0@AEBV0@@Z ??4CUTCProviderInfoCache@@QEAAAEAV0@AEBV0@@Z ??4KernelLoggingSession@@QEAAAEAV0@AEBV0@@Z ??4LoggingSession@@QEAAAEAV0@AEBV0@@Z ??_7KernelLoggingSession@@6B@ ??_7LoggingSession@@6B@ ??_FKernelLoggingSession@@QEAAXXZ ??_FLoggingSession@@QEAAXXZ ?AddExtFlagEntry@LoggingSession@@IEBAXGPEAXGPEAU_EVENT_TRACE_PROPERTIES_V2@@@Z ?AddFlagToTracingFlags@KernelLoggingSession@@MEAAHPEBG@Z ?AddFlagToTracingFlags@LoggingSession@@AEAAHPEBG_N@Z ?AddFlagToTracingFlags@LoggingSession@@MEAAHPEBG@Z ?AllocTraceProperties@LoggingSession@@KAPEAU_EVENT_TRACE_PROPERTIES_V2@@XZ ?CaptureState@KernelLoggingSession@@UEAAKPEBGE@Z ?CaptureState@LoggingSession@@UEAAKPEBGK@Z ?CleanupMarkResources@KernelLoggingSession@@SAXXZ ?ClearTracingFlags@KernelLoggingSession@@MEAAXXZ ?ClearTracingFlags@LoggingSession@@MEAAXXZ ?ControlTracing@KernelLoggingSession@@AEAAK_N@Z ?ControlTracing@LoggingSession@@AEAAK_N@Z ?CreateMergedETLFile@@YAKQEAPEAVLoggingSession@@KPEBG@Z ?CreateMergedETLFile@@YAKQEAPEBGKPEBG@Z ?CreateMergedETLFileEx@@YAKQEAPEBGKPEBGK@Z ?CreateProviderList@LoggingSession@@AEAAXXZ ?DisableBootTracing@KernelLoggingSession@@SAKXZ ?EnableBigFootTracing@KernelLoggingSession@@QEBAKHK@Z ?EnableBootTracing@KernelLoggingSession@@QEBAKXZ ?EnableLastBranchRecordingIfConfigured@LoggingSession@@IEAAJXZ ?EnablePmcCollectionIfConfigured@LoggingSession@@IEAAJXZ ?EnableProcessorTraceIfConfigured@LoggingSession@@IEAAJXZ ?EnableStackCaching@LoggingSession@@CAJ_KKK@Z ?EnableStackCachingIfConfigured@LoggingSession@@IEAAJXZ ?EnumEnabledFlags@LoggingSession@@QEAAJPEAKPEAPEAUFlagName@1@@Z ?EnumFlags@KernelLoggingSession@@UEBAPEBUFlagName@LoggingSession@@AEAK@Z ?EnumFlags@LoggingSession@@UEBAPEBUFlagName@1@AEAK@Z ?EnumGroups@KernelLoggingSession@@UEBAPEBUGroupName@LoggingSession@@AEAK@Z ?EnumGroups@LoggingSession@@UEBAPEBUGroupName@1@AEAK@Z ?EnumLoggers@LoggingSession@@SAKPEAPEAV1@AEAK@Z ?FlushLogger@KernelLoggingSession@@UEAAKXZ ?FlushLogger@LoggingSession@@UEAAKXZ ?FlushLoggerWithSuppressedEvents@KernelLoggingSession@@UEAAK_N@Z ?FlushLoggerWithSuppressedEvents@LoggingSession@@UEAAK_N@Z ?GetBootTracingStatus@KernelLoggingSession@@SAHPEAV1@@Z ?GetDecodedTraceFlags@LoggingSession@@QEBAKPEAGK@Z ?GetLastBranchRecordConfiguration@KernelLoggingSession@@QEAAHPEAU_LBR_SETTINGS@@@Z ?GetLastBranchRecordConfiguration@LoggingSession@@IEAAHPEAU_LBR_SETTINGS@@@Z ?GetOSVersionInfo@LoggingSession@@SAAEBU_OSVERSIONINFOEXW@@XZ ?GetPersistedGlobalLoggerKey@KernelLoggingSession@@CAKPEAGK@Z ?GetPmcConfiguration@KernelLoggingSession@@QEAAHPEAU_PMC_SETTINGS@@@Z ?GetPmcConfiguration@LoggingSession@@IEAAHPEAU_PMC_SETTINGS@@@Z ?GetProcessorTraceConfiguration@KernelLoggingSession@@QEAAHPEAU_IPT_SETTINGS@@@Z ?GetProcessorTraceConfiguration@LoggingSession@@IEAAHPEAU_IPT_SETTINGS@@@Z ?GetProviderInfo@CProviderInfoCache@@QEBAPEBUCProviderInfo@@AEBU_GUID@@@Z ?GetProviderInfo@CProviderInfoCache@@QEBAPEBUCProviderInfo@@PEBG@Z ?GetRunningEtwInternalVersion@KernelLoggingSession@@SAKXZ ?GetRunningOSMaximumStackWalkedKernelEventTypes@KernelLoggingSession@@SAKXZ ?GetSessionHandle@LoggingSession@@QEBA_KXZ ?GetStackCaching@KernelLoggingSession@@QEBAHPEAK0@Z ?GetStackCaching@LoggingSession@@IEBAHPEAK0@Z ?GetStackWalkingFlag@CKernelStackWalkingFlagTranslator@@SAPEBUCStackWalkingFlag@1@G@Z ?GetStackWalkingFlag@CKernelStackWalkingFlagTranslator@@SAPEBUCStackWalkingFlag@1@PEBG@Z ?GetTraceFlags@KernelLoggingSession@@UEBAKPEAGK@Z ?GetTraceFlags@LoggingSession@@UEBAKPEAGK@Z ?GetTraceFlagsEx@LoggingSession@@AEBAKPEAGK_N@Z ?InitTraceProperties@KernelLoggingSession@@MEBAPEAU_EVENT_TRACE_PROPERTIES_V2@@XZ ?InitTraceProperties@LoggingSession@@MEBAPEAU_EVENT_TRACE_PROPERTIES_V2@@XZ ?Initialize@CPerfTrackProviderInfoCache@@AEAAJPEBVCProviderInfoCache@@@Z ?Initialize@CUTCProviderInfoCache@@AEAAJPEBVCProviderInfoCache@@@Z ?IsKernelLogger@LoggingSession@@QEBAHXZ ?IsLogging@LoggingSession@@QEBA_NXZ ?IsProviderAvailable@LoggingSession@@UEBAHAEBU_GUID@@@Z ?IsProviderAvailable@LoggingSession@@UEBAHPEBG@Z ?IsSpinlockSupported@LoggingSession@@SA_NXZ ?IsWin8@LoggingSession@@SA_NXZ ?IsWin8AndUp@LoggingSession@@SA_NXZ ?LogFileName@LoggingSession@@QEBAPEBGXZ ?LogMark@LoggingSession@@UEAAKEKEEGPEBG_N@Z ?LogMark@LoggingSession@@UEAAKEPEAU_PERFINFO_MARK_EVENT@@_K_N@Z ?LoggerName@KernelLoggingSession@@SAPEBGXZ ?ProviderListAddFlag@LoggingSession@@AEAAHPEAPEAUProviderGUIDEntry@1@PEBG_N@Z ?ProviderListAddGUID@LoggingSession@@AEAAHPEAPEAUProviderGUIDEntry@1@AEBU_GUID@@_KK_NK@Z ?ProviderListClear@LoggingSession@@AEAAXPEAPEAUProviderGUIDEntry@1@@Z ?ProviderListProcessFlags@LoggingSession@@AEAAHPEAPEAUProviderGUIDEntry@1@PEBG@Z ?QueryGroupMask@KernelLoggingSession@@QEAAAEBU_PERFINFO_GROUPMASK@@_N@Z ?QueryPerfTrackProviderInfos@LoggingSession@@SAJPEAKPEAPEBUCProviderInfo@@@Z ?QueryPoolTagFilter@LoggingSession@@IEAAJXZ ?QueryProviderInfos@CPerfTrackProviderInfoCache@@QEBAJPEAKPEAPEBUCProviderInfo@@@Z ?QueryProviderInfos@CProviderInfoCache@@QEBAJPEAKPEAPEBUCProviderInfo@@@Z ?QueryProviderInfos@CUTCProviderInfoCache@@QEBAJPEAKPEAPEBUCProviderInfo@@@Z ?QueryProviderInfos@LoggingSession@@SAJPEAKPEAPEBUCProviderInfo@@@Z ?QuerySessionHandleFromName@LoggingSession@@CAKPEA_KPEBG@Z ?QueryStackWalkingFlags@CKernelStackWalkingFlagTranslator@@SAJPEAKPEAPEBUCStackWalkingFlag@1@@Z ?QueryStackWalkingFlags@CKernelStackWalkingFlagTranslator@@SAJQEAUCStackWalkingFlag@1@AEAKH@Z ?QueryUTCProviderInfos@LoggingSession@@SAJPEAKPEAPEBUCProviderInfo@@@Z ?QueryVirtualAllocCommitSizeStkMin@KernelLoggingSession@@SAKAEAK@Z ?QueryVirtualAllocResSizeStkMin@KernelLoggingSession@@SAKAEAK@Z ?RunningOSSupportsKernelEventStackwalking@KernelLoggingSession@@SAHXZ ?RunningOSUsesVistaStyleKernelEventStackwalkingControlDescriptors@KernelLoggingSession@@SAHXZ ?SessionName@LoggingSession@@QEBAPEBGXZ ?SessionProperties@LoggingSession@@QEAAAEBUSESSION_PROPERTIES@@_N@Z ?SessionProperties@LoggingSession@@QEAAHAEBUSESSION_PROPERTIES@@@Z ?SetLastBranchRecordConfiguration@KernelLoggingSession@@QEAAXQEAU_LBR_SETTINGS@@@Z ?SetLastBranchRecordConfiguration@LoggingSession@@IEAAXQEAU_LBR_SETTINGS@@@Z ?SetLogFileName@LoggingSession@@UEAAHPEBG@Z ?SetMark@KernelLoggingSession@@SAHPEBGH@Z ?SetPmcConfiguration@KernelLoggingSession@@QEAAXPEBU_PMC_SETTINGS@@_N@Z ?SetPmcConfiguration@LoggingSession@@IEAAXPEBU_PMC_SETTINGS@@@Z ?SetPoolTagFilter@KernelLoggingSession@@UEAAJPEBG@Z ?SetPoolTagFilter@LoggingSession@@UEAAJPEBG@Z ?SetProcessorTraceConfiguration@KernelLoggingSession@@QEAAXQEAU_IPT_SETTINGS@@@Z ?SetProcessorTraceConfiguration@LoggingSession@@IEAAXQEAU_IPT_SETTINGS@@@Z ?SetSessionName@KernelLoggingSession@@UEAAHPEBG@Z ?SetSessionName@LoggingSession@@UEAAHPEBG@Z ?SetStackCaching@KernelLoggingSession@@QEAAXKK@Z ?SetStackCaching@LoggingSession@@IEAAXKK@Z ?SetTraceFlags@LoggingSession@@UEAAHPEBG@Z ?SetVirtualAllocCommitSizeStkMin@KernelLoggingSession@@SAKK@Z ?SetVirtualAllocResSizeStkMin@KernelLoggingSession@@SAKK@Z ?StartTracing@KernelLoggingSession@@UEAAKXZ ?StartTracing@LoggingSession@@UEAAKXZ ?StopTracing@KernelLoggingSession@@UEAAKXZ ?StopTracing@LoggingSession@@UEAAKXZ ?StringToGuid@LoggingSession@@SAHPEBGPEAU_GUID@@@Z ?TranslateFlagString@CKernelStackWalkingFlagTranslator@@SAJQEAUCStackWalkingFlag@1@AEAKPEBGPEAUCParsingErrorInformation@1@@Z ?UpdateTracing@KernelLoggingSession@@UEAAKXZ ?UpdateTracing@LoggingSession@@UEAAKXZ ?get_m_FlagNames@LoggingSession@@AEBAPEAUFlagName@1@XZ ?pSetTraceFlags@LoggingSession@@MEAAHPEBG@Z ?put_m_FlagNames@LoggingSession@@AEAAXPEAUFlagName@1@@Z ?s_MarkHandle@KernelLoggingSession@@0PEAXEA ?s_bEtwSetMark@KernelLoggingSession@@0_NA ?s_cKnownUserModeFlagLen@LoggingSession@@1KB ?s_cKnownUserModeFlags@LoggingSession@@2QBUFlagName@1@B ?s_cNumKnownUserModeFlags@LoggingSession@@2KB ?s_cNumUserModeGroups@LoggingSession@@2KB ?s_cUserModeGroups@LoggingSession@@2QBUGroupName@1@B ?s_pfnEtwSetMark@KernelLoggingSession@@0P6AK_KPEAU_ETW_SET_MARK_INFORMATION@@K@ZEA

Name

.text

Size

697KB

Virtual Size

697KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

174KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ee1cd2c72482f464eee2321ee8e1fdb3a1f26fbba488ba96eb9ec5838fb29cf4

wininet

kernel32

user32

generic